CVE-2026-113470 in Firefox
Summary
by MITRE • 10/20/2026
Mozilla blocked compromised intermediate eMudhra certificates via OneCRL on the 17th of October which was distributed to clients via RemoteSettings the same day. This update contains the updated OneCRL block list, ensuring clients will block the compromised certificates even if RemoteSettings is disabled by policy or otherwise unavailable in the user's network environment. This vulnerability was fixed in Firefox 158.0.1, Firefox ESR 153.5.1, and Firefox ESR 115.43.1.
Be aware that VulDB is the high quality source for vulnerability data.
Analysis
by VulDB Data Team • 10/20/2026
The security incident involving compromised intermediate certificates issued by eMudhra represents a significant breach of the Public Key Infrastructure trust model. The root cause lies in the compromise or improper issuance of specific intermediate CA certificates that were used to sign end-entity TLS/SSL certificates. When an intermediate certificate is compromised, any digital identity signed under it can no longer be trusted because attackers may possess the private key associated with that intermediate certificate. This allows malicious actors to impersonate legitimate websites, perform man-in-the-middle attacks, or intercept encrypted communications without detection by standard browser security mechanisms. The presence of such certificates in the trust store undermines the fundamental assumption that a valid chain of certification leads to a trustworthy entity.
Mozilla addressed this vulnerability through an emergency update mechanism known as OneCRL, which is distributed via RemoteSettings. On October 17th, Mozilla pushed an updated block list containing the identifiers of the compromised eMudhra intermediate certificates directly to client installations. This approach ensures rapid propagation of the revocation data across the user base without requiring a full browser version update for every affected system immediately. The OneCRL mechanism operates at the certificate verification level within the NSS library, allowing Firefox and its derivatives to reject connections that rely on these specific compromised intermediates during TLS handshakes. This proactive blocking is critical because traditional Certificate Revocation Lists (CRLs) or Online Certificate Status Protocol (OCSP) responses might not be updated quickly enough by the CA itself, leaving users vulnerable for a longer period.
A key technical feature of this mitigation strategy is its resilience against network restrictions and policy configurations. The update ensures that clients will block the compromised certificates even if RemoteSettings functionality is disabled via enterprise policies or if the user's network environment prevents access to Mozilla's remote settings servers. This redundancy is achieved by bundling the updated OneCRL data within the browser binary itself during subsequent patch releases, ensuring that the revocation information persists locally regardless of external connectivity or administrative restrictions on telemetry and update channels. This design choice aligns with industry best practices for maintaining security posture in environments where internet access might be restricted or monitored heavily, such as corporate intranets or government networks.
The vulnerability was officially remediated in Firefox version 158.0.1, Firefox Extended Support Release (ESR) version 153.5.1, and the legacy ESR branch at version 115.43.1. Organizations relying on these browser versions must ensure that their deployment pipelines are updated to include these specific builds to mitigate the risk of credential theft or data interception via compromised certificates. From a classification perspective, this incident relates closely to CWE-295 Improper Certificate Validation and CWE-613 Insufficient Session Expiration, as it involves the failure to properly validate the trust chain due to compromised root or intermediate authorities. In terms of MITRE ATT&CK framework mapping, this scenario falls under T1078 Valid Accounts if attackers use stolen certificates for impersonation, but more accurately reflects infrastructure compromise aspects where trusted entities are subverted.
To further mitigate risks associated with certificate-based attacks, organizations should implement Certificate Transparency (CT) logging monitoring to detect unauthorized or anomalous certificate issuances early. Additionally, enforcing HTTP Strict Transport Security (HSTS) preload lists can help prevent downgrade attacks and ensure that connections remain encrypted even if a compromised certificate is momentarily accepted by older browser versions. Regular auditing of installed certificates and keeping all software components up to date are essential practices for maintaining a robust security posture against evolving threats in the public key infrastructure ecosystem.